guest VRF not able to access internet

[tachyon05]

RO ............  SDWAN  ..............  HQ --- Internet
Remote Office                         Headquarters
 |                                      |
 |------------- guest VRF --------------|

RO connects to HQ via BGP over a SDWAN solution.  Both RO and HQ network use EIGRP otherwise.

Issue is Guest users at RO are not able to access internet.

On RO, show IP route vrf guest displays correct GRE tunnel routes and a default route learned from HQ.  ping vrf guest [tunnel destination on HQ] works.

At HQ, show ip route vrf guest displays correct GRE tunnel routes.  ping vrf guest [tunnel destination / guest SVI on RO] works.  ping vrf guest [internet public IPs] works.

What could be preventing RO guests from accessing internet?

[Flavio Miranda]

Hi

 DNS lookup on RO guest vrf?

[tachyon05]

PINGs using IP addresses are not working so not a DNS issue.  Thanks

[Flavio Miranda]

"ping vrf guest [internet public IPs] works."

When I saw this, I undertood the user are able to ping on the internet . What do you call " internet public IP address"?

 Traceroute from guest vrf towards internet  stops where?

What about NAT? Where the NAT is happening?

[paul driver]

Hello

---

@tachyon05 wrote:
On RO, show IP route vrf guest displays correct GRE tunnel routes and a default route learned from HQ. 
What could be preventing RO guests from accessing internet?

---

Within the vrf table is the default route pointing to the global rib table at HQ
Example:
ip route vrf guest 0.0.0.0 0.0.0.0 x.x.x.x global

[tachyon05]

There are no NATs, no firewall, and no DNS in this case, and I am only using PINGs and IP addresses.

Commands ran on RO
ping vrf guest [public IP] fails
show IP route vrf guest confirms a default route is learned from the other side of the GRE tunnel / HQ.
trace vrf guest [public IP] shows first hop is the GRE tunnel interface IP configured on HQ, hops 2 - 30 are all ***.

Commands ran on HQ
ping vrf guest [guest SVI on RO] works
ping vrf guest [guest SVI on RO] source [tunnel IP on HQ] works
ping vrf guest [public IP] works
ping vrf guest [public IP] source [tunnel IP on HQ] fails !!! this is probably the cause?

[tachyon05]

Issue was resolved after learning a return route was missing from one of the devices at HQ.  Thanks everyone!